release-skill 0.1.4 → 0.1.5

package/adapters/codex/bin/release-skill.bundle.mjs

@@ -19947,7 +19947,7 @@ async function writePlanImmutable(planPath, plan) {
   }
   return { planPath, planDigest };
 }
-function validatePlanActionCompleteness(plan) {
+function validatePlanActionCompleteness(plan, options = {}) {
   const failures = [];
   if (!plan || typeof plan !== "object") {
     return { passed: false, details: { failures: ["plan is null or not an object"], expectedCount: 0, actualCount: 0 } };
@@ -20254,6 +20254,26 @@ function validatePlanActionCompleteness(plan) {
           _checkRequired(action, "parameters.ref", action.parameters?.ref, expectedTag, unitId, failures);
           _checkRequired(action, "parameters.manifestDigest", action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
+        {
+          const raw = action.parameters?.timeoutMs;
+          if (raw === void 0) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs is missing, expected a valid timeout (30000-900000)`
+              );
+            }
+          } else {
+            if (typeof raw !== "number" || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`
+              );
+            } else if (raw < 3e4 || raw > 9e5) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be between 30000 and 900000, got: ${raw}`
+              );
+            }
+          }
+        }
         _checkRequired(action, "expected.installed", action.expected?.installed, true, unitId, failures);
         _checkRequired(action, "expected.plugin", action.expected?.plugin, plugin, unitId, failures);
         _checkRequired(action, "expected.marketplace", action.expected?.marketplace, marketplace, unitId, failures);
@@ -20322,6 +20342,26 @@ function validatePlanActionCompleteness(plan) {
           _checkRequired(action, "parameters.ref", action.parameters?.ref, expectedTag, unitId, failures);
           _checkRequired(action, "parameters.manifestDigest", action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
+        {
+          const raw = action.parameters?.timeoutMs;
+          if (raw === void 0) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs is missing, expected a valid timeout (30000-900000)`
+              );
+            }
+          } else {
+            if (typeof raw !== "number" || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`
+              );
+            } else if (raw < 3e4 || raw > 9e5) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be between 30000 and 900000, got: ${raw}`
+              );
+            }
+          }
+        }
         _checkRequired(action, "expected.installed", action.expected?.installed, true, unitId, failures);
         _checkRequired(action, "expected.plugin", action.expected?.plugin, plugin, unitId, failures);
         _checkRequired(action, "expected.marketplace", action.expected?.marketplace, marketplace, unitId, failures);
@@ -68159,6 +68199,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const claudeDist = (unit.distributions ?? []).find((d) => d.type === "claude-plugin");
       if (claudeDist) {
         const identity = marketplaceIdentity(claudeDist);
+        const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 3e5;
         actions.push({
           id: `claude-marketplace-install-${unit.id}`,
           type: "claude-marketplace-install",
@@ -68170,7 +68211,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             marketplace: identity.marketplace,
             repo: unit.publicRepo,
             version,
-            entrySkill: identity.entrySkill
+            entrySkill: identity.entrySkill,
+            timeoutMs: claudeTimeoutMs
           },
           expected: {
             installed: true,
@@ -68185,6 +68227,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const codexDist = (unit.distributions ?? []).find((d) => d.type === "codex-plugin");
       if (codexDist) {
         const identity = marketplaceIdentity(codexDist);
+        const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 3e5;
         actions.push({
           id: `codex-marketplace-install-${unit.id}`,
           type: "codex-marketplace-install",
@@ -68196,7 +68239,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             marketplace: identity.marketplace,
             repo: unit.publicRepo,
             version,
-            entrySkill: identity.entrySkill
+            entrySkill: identity.entrySkill,
+            timeoutMs: codexTimeoutMs
           },
           expected: {
             installed: true,
@@ -68336,6 +68380,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const claudeDist = (unit.distributions ?? []).find((d) => d.type === "claude-plugin");
     if (claudeDist) {
       const identity = marketplaceIdentity(claudeDist);
+      const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 3e5;
       actions.push({
         id: `claude-marketplace-install-${unit.id}`,
         type: "claude-marketplace-install",
@@ -68350,7 +68395,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           version: unitVersion,
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
-          manifestDigest: asset.manifestDigest
+          manifestDigest: asset.manifestDigest,
+          timeoutMs: claudeTimeoutMs
         },
         expected: {
           installed: true,
@@ -68370,6 +68416,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const codexDist = (unit.distributions ?? []).find((d) => d.type === "codex-plugin");
     if (codexDist) {
       const identity = marketplaceIdentity(codexDist);
+      const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 3e5;
       actions.push({
         id: `codex-marketplace-install-${unit.id}`,
         type: "codex-marketplace-install",
@@ -68384,7 +68431,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           version: unitVersion,
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
-          manifestDigest: asset.manifestDigest
+          manifestDigest: asset.manifestDigest,
+          timeoutMs: codexTimeoutMs
         },
         expected: {
           installed: true,
@@ -69526,7 +69574,7 @@ async function reconcileRelease(options) {
     }
     await evidence.append({ phase: "safety-gate", gate: "plan-digest", status: "passed" });
     await evidence.append({ phase: "safety-gate", gate: "action-completeness", status: "started" });
-    const completenessResult = validatePlanActionCompleteness(plan);
+    const completenessResult = validatePlanActionCompleteness(plan, { legacyCompatibility: true });
     if (!completenessResult.passed) {
       await evidence.append({
         phase: "safety-gate",
@@ -71194,6 +71242,23 @@ function validateMarketplaceParams(params) {
   }
   return { valid: true, error: null };
 }
+function resolveTimeoutMs(action) {
+  const raw = action?.timeoutMs;
+  if (raw === void 0) {
+    return 3e5;
+  }
+  if (raw === null || typeof raw !== "number" || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+    throw new Error(
+      `action.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`
+    );
+  }
+  if (raw < 3e4 || raw > 9e5) {
+    throw new Error(
+      `action.timeoutMs must be between 30000 and 900000, got: ${raw}`
+    );
+  }
+  return raw;
+}
 async function run4(cmd, args2, options = {}) {
   return execFile9(cmd, args2, {
     shell: false,
@@ -71663,11 +71728,21 @@ function createPluginMarketplaceAdapter(deps = {}) {
             ...baseEnv,
             ...consumer === "claude" ? { HOME: isolatedHome, CLAUDE_CONFIG_DIR: resolve18(isolatedHome, ".claude") } : { HOME: isolatedHome, CODEX_HOME: isolatedHome }
           };
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.EXECUTE_FAILED,
+              error: timeoutErr.message
+            });
+          }
           const ref = action.ref ?? `v${action.version}`;
           let addOutput;
           const marketplaceArgs = consumer === "claude" ? ["plugin", "marketplace", "add", `${action.repo}@${ref}`] : ["plugin", "marketplace", "add", action.repo, "--ref", ref, "--json"];
           try {
-            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root });
+            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === "codex") {
               try {
                 addOutput = JSON.parse(addResult.stdout);
@@ -71703,7 +71778,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           let installOutput;
           const installArgs = consumer === "claude" ? ["plugin", "install", `${action.plugin}@${action.marketplace}`] : ["plugin", "add", `${action.plugin}@${action.marketplace}`, "--json"];
           try {
-            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root });
+            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === "codex") {
               try {
                 installOutput = JSON.parse(installResult.stdout);
@@ -71893,6 +71968,17 @@ function createPluginMarketplaceAdapter(deps = {}) {
             ...baseEnv,
             ...consumer === "claude" ? { HOME: isolatedHome, CLAUDE_CONFIG_DIR: resolve18(isolatedHome, ".claude") } : { HOME: isolatedHome, CODEX_HOME: isolatedHome }
           };
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.OBSERVED,
+              observation: { installed: false, error: timeoutErr.message },
+              error: timeoutErr.message
+            });
+          }
           let evidence = null;
           try {
             const evidenceRaw = await readFile16(resolve18(runDir, "evidence", `${consumer}-${action.plugin}`, "release-skill-install-evidence.json"), "utf8");
@@ -71920,7 +72006,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           const listArgs = consumer === "claude" ? ["plugin", "list", "--json"] : ["plugin", "list", "--json"];
           let listOutput;
           try {
-            const result = await exec(cliCmd, listArgs, { env, cwd: context.root });
+            const result = await exec(cliCmd, listArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             listOutput = JSON.parse(result.stdout);
           } catch (listErr) {
             return createResult({
@@ -72248,6 +72334,7 @@ var init_plugin_marketplace = __esm({
     STRICT_SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
     __name(validateSafeRef, "validateSafeRef");
     __name(validateMarketplaceParams, "validateMarketplaceParams");
+    __name(resolveTimeoutMs, "resolveTimeoutMs");
     __name(run4, "run");
     __name(validateManifestFile, "validateManifestFile");
     __name(checkRequiredFiles, "checkRequiredFiles");
@@ -72668,7 +72755,7 @@ async function verifyRelease(options) {
       }
       validateApproval(plan, approval, { clock: clockFn, requireUnexpired: false });
     }
-    const completenessResult = validatePlanActionCompleteness(plan);
+    const completenessResult = validatePlanActionCompleteness(plan, { legacyCompatibility: true });
     if (!completenessResult.passed) {
       throw new ReleaseError(
         GATE_FAILED,

package/adapters/codex/schemas/release-project.schema.json

@@ -200,6 +200,12 @@
                 },
                 "smokeExpectedJson": {
                   "type": "object"
+                },
+                "timeoutMs": {
+                  "type": "integer",
+                  "minimum": 30000,
+                  "maximum": 900000,
+                  "description": "Timeout in milliseconds for plugin marketplace install commands. Only valid for claude-plugin and codex-plugin distributions."
                 }
               },
               "allOf": [
@@ -219,6 +225,23 @@
                     ]
                   }
                 },
+                {
+                  "if": {
+                    "required": [
+                      "timeoutMs"
+                    ]
+                  },
+                  "then": {
+                    "properties": {
+                      "type": {
+                        "enum": [
+                          "claude-plugin",
+                          "codex-plugin"
+                        ]
+                      }
+                    }
+                  }
+                },
                 {
                   "if": {
                     "properties": {

package/bin/release-skill.bundle.mjs

@@ -19947,7 +19947,7 @@ async function writePlanImmutable(planPath, plan) {
   }
   return { planPath, planDigest };
 }
-function validatePlanActionCompleteness(plan) {
+function validatePlanActionCompleteness(plan, options = {}) {
   const failures = [];
   if (!plan || typeof plan !== "object") {
     return { passed: false, details: { failures: ["plan is null or not an object"], expectedCount: 0, actualCount: 0 } };
@@ -20254,6 +20254,26 @@ function validatePlanActionCompleteness(plan) {
           _checkRequired(action, "parameters.ref", action.parameters?.ref, expectedTag, unitId, failures);
           _checkRequired(action, "parameters.manifestDigest", action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
+        {
+          const raw = action.parameters?.timeoutMs;
+          if (raw === void 0) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs is missing, expected a valid timeout (30000-900000)`
+              );
+            }
+          } else {
+            if (typeof raw !== "number" || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`
+              );
+            } else if (raw < 3e4 || raw > 9e5) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be between 30000 and 900000, got: ${raw}`
+              );
+            }
+          }
+        }
         _checkRequired(action, "expected.installed", action.expected?.installed, true, unitId, failures);
         _checkRequired(action, "expected.plugin", action.expected?.plugin, plugin, unitId, failures);
         _checkRequired(action, "expected.marketplace", action.expected?.marketplace, marketplace, unitId, failures);
@@ -20322,6 +20342,26 @@ function validatePlanActionCompleteness(plan) {
           _checkRequired(action, "parameters.ref", action.parameters?.ref, expectedTag, unitId, failures);
           _checkRequired(action, "parameters.manifestDigest", action.parameters?.manifestDigest, frozen?.manifestDigest, unitId, failures);
         }
+        {
+          const raw = action.parameters?.timeoutMs;
+          if (raw === void 0) {
+            if (!options.legacyCompatibility) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs is missing, expected a valid timeout (30000-900000)`
+              );
+            }
+          } else {
+            if (typeof raw !== "number" || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`
+              );
+            } else if (raw < 3e4 || raw > 9e5) {
+              failures.push(
+                `unit "${unitId}", action "${action.id}": parameters.timeoutMs must be between 30000 and 900000, got: ${raw}`
+              );
+            }
+          }
+        }
         _checkRequired(action, "expected.installed", action.expected?.installed, true, unitId, failures);
         _checkRequired(action, "expected.plugin", action.expected?.plugin, plugin, unitId, failures);
         _checkRequired(action, "expected.marketplace", action.expected?.marketplace, marketplace, unitId, failures);
@@ -68159,6 +68199,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const claudeDist = (unit.distributions ?? []).find((d) => d.type === "claude-plugin");
       if (claudeDist) {
         const identity = marketplaceIdentity(claudeDist);
+        const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 3e5;
         actions.push({
           id: `claude-marketplace-install-${unit.id}`,
           type: "claude-marketplace-install",
@@ -68170,7 +68211,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             marketplace: identity.marketplace,
             repo: unit.publicRepo,
             version,
-            entrySkill: identity.entrySkill
+            entrySkill: identity.entrySkill,
+            timeoutMs: claudeTimeoutMs
           },
           expected: {
             installed: true,
@@ -68185,6 +68227,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
       const codexDist = (unit.distributions ?? []).find((d) => d.type === "codex-plugin");
       if (codexDist) {
         const identity = marketplaceIdentity(codexDist);
+        const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 3e5;
         actions.push({
           id: `codex-marketplace-install-${unit.id}`,
           type: "codex-marketplace-install",
@@ -68196,7 +68239,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
             marketplace: identity.marketplace,
             repo: unit.publicRepo,
             version,
-            entrySkill: identity.entrySkill
+            entrySkill: identity.entrySkill,
+            timeoutMs: codexTimeoutMs
           },
           expected: {
             installed: true,
@@ -68336,6 +68380,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const claudeDist = (unit.distributions ?? []).find((d) => d.type === "claude-plugin");
     if (claudeDist) {
       const identity = marketplaceIdentity(claudeDist);
+      const claudeTimeoutMs = Number.isInteger(claudeDist.timeoutMs) ? claudeDist.timeoutMs : 3e5;
       actions.push({
         id: `claude-marketplace-install-${unit.id}`,
         type: "claude-marketplace-install",
@@ -68350,7 +68395,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           version: unitVersion,
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
-          manifestDigest: asset.manifestDigest
+          manifestDigest: asset.manifestDigest,
+          timeoutMs: claudeTimeoutMs
         },
         expected: {
           installed: true,
@@ -68370,6 +68416,7 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
     const codexDist = (unit.distributions ?? []).find((d) => d.type === "codex-plugin");
     if (codexDist) {
       const identity = marketplaceIdentity(codexDist);
+      const codexTimeoutMs = Number.isInteger(codexDist.timeoutMs) ? codexDist.timeoutMs : 3e5;
       actions.push({
         id: `codex-marketplace-install-${unit.id}`,
         type: "codex-marketplace-install",
@@ -68384,7 +68431,8 @@ function buildExternalActions(unitResults, resolvedVersions, productionAssets) {
           version: unitVersion,
           entrySkill: identity.entrySkill,
           snapshotPath: asset.snapshotPath,
-          manifestDigest: asset.manifestDigest
+          manifestDigest: asset.manifestDigest,
+          timeoutMs: codexTimeoutMs
         },
         expected: {
           installed: true,
@@ -69526,7 +69574,7 @@ async function reconcileRelease(options) {
     }
     await evidence.append({ phase: "safety-gate", gate: "plan-digest", status: "passed" });
     await evidence.append({ phase: "safety-gate", gate: "action-completeness", status: "started" });
-    const completenessResult = validatePlanActionCompleteness(plan);
+    const completenessResult = validatePlanActionCompleteness(plan, { legacyCompatibility: true });
     if (!completenessResult.passed) {
       await evidence.append({
         phase: "safety-gate",
@@ -71194,6 +71242,23 @@ function validateMarketplaceParams(params) {
   }
   return { valid: true, error: null };
 }
+function resolveTimeoutMs(action) {
+  const raw = action?.timeoutMs;
+  if (raw === void 0) {
+    return 3e5;
+  }
+  if (raw === null || typeof raw !== "number" || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+    throw new Error(
+      `action.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`
+    );
+  }
+  if (raw < 3e4 || raw > 9e5) {
+    throw new Error(
+      `action.timeoutMs must be between 30000 and 900000, got: ${raw}`
+    );
+  }
+  return raw;
+}
 async function run4(cmd, args2, options = {}) {
   return execFile9(cmd, args2, {
     shell: false,
@@ -71663,11 +71728,21 @@ function createPluginMarketplaceAdapter(deps = {}) {
             ...baseEnv,
             ...consumer === "claude" ? { HOME: isolatedHome, CLAUDE_CONFIG_DIR: resolve18(isolatedHome, ".claude") } : { HOME: isolatedHome, CODEX_HOME: isolatedHome }
           };
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.EXECUTE_FAILED,
+              error: timeoutErr.message
+            });
+          }
           const ref = action.ref ?? `v${action.version}`;
           let addOutput;
           const marketplaceArgs = consumer === "claude" ? ["plugin", "marketplace", "add", `${action.repo}@${ref}`] : ["plugin", "marketplace", "add", action.repo, "--ref", ref, "--json"];
           try {
-            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root });
+            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === "codex") {
               try {
                 addOutput = JSON.parse(addResult.stdout);
@@ -71703,7 +71778,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           let installOutput;
           const installArgs = consumer === "claude" ? ["plugin", "install", `${action.plugin}@${action.marketplace}`] : ["plugin", "add", `${action.plugin}@${action.marketplace}`, "--json"];
           try {
-            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root });
+            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === "codex") {
               try {
                 installOutput = JSON.parse(installResult.stdout);
@@ -71893,6 +71968,17 @@ function createPluginMarketplaceAdapter(deps = {}) {
             ...baseEnv,
             ...consumer === "claude" ? { HOME: isolatedHome, CLAUDE_CONFIG_DIR: resolve18(isolatedHome, ".claude") } : { HOME: isolatedHome, CODEX_HOME: isolatedHome }
           };
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.OBSERVED,
+              observation: { installed: false, error: timeoutErr.message },
+              error: timeoutErr.message
+            });
+          }
           let evidence = null;
           try {
             const evidenceRaw = await readFile16(resolve18(runDir, "evidence", `${consumer}-${action.plugin}`, "release-skill-install-evidence.json"), "utf8");
@@ -71920,7 +72006,7 @@ function createPluginMarketplaceAdapter(deps = {}) {
           const listArgs = consumer === "claude" ? ["plugin", "list", "--json"] : ["plugin", "list", "--json"];
           let listOutput;
           try {
-            const result = await exec(cliCmd, listArgs, { env, cwd: context.root });
+            const result = await exec(cliCmd, listArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             listOutput = JSON.parse(result.stdout);
           } catch (listErr) {
             return createResult({
@@ -72248,6 +72334,7 @@ var init_plugin_marketplace = __esm({
     STRICT_SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$/;
     __name(validateSafeRef, "validateSafeRef");
     __name(validateMarketplaceParams, "validateMarketplaceParams");
+    __name(resolveTimeoutMs, "resolveTimeoutMs");
     __name(run4, "run");
     __name(validateManifestFile, "validateManifestFile");
     __name(checkRequiredFiles, "checkRequiredFiles");
@@ -72668,7 +72755,7 @@ async function verifyRelease(options) {
       }
       validateApproval(plan, approval, { clock: clockFn, requireUnexpired: false });
     }
-    const completenessResult = validatePlanActionCompleteness(plan);
+    const completenessResult = validatePlanActionCompleteness(plan, { legacyCompatibility: true });
     if (!completenessResult.passed) {
       throw new ReleaseError(
         GATE_FAILED,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "release-skill",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Safe preparation and frozen GitHub/npm production publishing with full happy end verification",
   "repository": {
     "type": "git",

package/schemas/release-project.schema.json

@@ -200,6 +200,12 @@
                 },
                 "smokeExpectedJson": {
                   "type": "object"
+                },
+                "timeoutMs": {
+                  "type": "integer",
+                  "minimum": 30000,
+                  "maximum": 900000,
+                  "description": "Timeout in milliseconds for plugin marketplace install commands. Only valid for claude-plugin and codex-plugin distributions."
                 }
               },
               "allOf": [
@@ -219,6 +225,23 @@
                     ]
                   }
                 },
+                {
+                  "if": {
+                    "required": [
+                      "timeoutMs"
+                    ]
+                  },
+                  "then": {
+                    "properties": {
+                      "type": {
+                        "enum": [
+                          "claude-plugin",
+                          "codex-plugin"
+                        ]
+                      }
+                    }
+                  }
+                },
                 {
                   "if": {
                     "properties": {

package/src/adapters/plugin-marketplace.mjs

@@ -185,6 +185,42 @@ function validateMarketplaceParams(params) {
 }
 
 
+/**
+ * Resolve and validate the frozen timeoutMs from the expanded adapter action.
+ *
+ * The publish/reconcile/verify call path expands plan actions as
+ * `{ actionType, ...action.parameters }`, so `parameters.timeoutMs` in the
+ * plan becomes `action.timeoutMs` at the adapter level. This function reads
+ * from the top-level action, not from a nested `parameters` sub-object.
+ *
+ * Rules:
+ * - Missing field (undefined): returns 300000 default (legacy compatibility).
+ * - Present but null/invalid (null, string, NaN, Infinity, non-integer,
+ *   out of range): fail-closed, throws.
+ * - Valid integer in [30000, 900000]: returns the value as-is.
+ *
+ * @param {object} action - The expanded adapter action (top-level).
+ * @returns {number} Validated timeout in milliseconds.
+ * @throws {Error} If the value is present but invalid.
+ */
+function resolveTimeoutMs(action) {
+  const raw = action?.timeoutMs;
+  if (raw === undefined) {
+    return 300000;
+  }
+  if (raw === null || typeof raw !== 'number' || !Number.isFinite(raw) || !Number.isInteger(raw)) {
+    throw new Error(
+      `action.timeoutMs must be a finite integer, got: ${JSON.stringify(raw)}`,
+    );
+  }
+  if (raw < 30000 || raw > 900000) {
+    throw new Error(
+      `action.timeoutMs must be between 30000 and 900000, got: ${raw}`,
+    );
+  }
+  return raw;
+}
+
 /**
  * Run a CLI command using execFile (never shell: true).
  */
@@ -792,6 +828,23 @@ export function createPluginMarketplaceAdapter(deps = {}) {
           };
           // Ensure real HOME/CODEX_HOME don't leak back (already overridden above)
 
+          // Resolve frozen timeoutMs from the expanded action (top-level,
+          // not action.parameters -- the publish/reconcile/verify call path
+          // expands plan action as { actionType, ...action.parameters }).
+          // Default to 300000 for old plans that lack the field.
+          // Fail closed on invalid values (null, non-integer, non-finite,
+          // out of range).
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.EXECUTE_FAILED,
+              error: timeoutErr.message,
+            });
+          }
+
           // Step 1: Add marketplace
           const ref = action.ref ?? `v${action.version}`;
           let addOutput;
@@ -799,7 +852,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             ? ['plugin', 'marketplace', 'add', `${action.repo}@${ref}`]
             : ['plugin', 'marketplace', 'add', action.repo, '--ref', ref, '--json'];
           try {
-            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root });
+            const addResult = await exec(cliCmd, marketplaceArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === 'codex') {
               try {
                 addOutput = JSON.parse(addResult.stdout);
@@ -839,7 +892,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
             ? ['plugin', 'install', `${action.plugin}@${action.marketplace}`]
             : ['plugin', 'add', `${action.plugin}@${action.marketplace}`, '--json'];
           try {
-            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root });
+            const installResult = await exec(cliCmd, installArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             if (consumer === 'codex') {
               try {
                 installOutput = JSON.parse(installResult.stdout);
@@ -1053,6 +1106,20 @@ export function createPluginMarketplaceAdapter(deps = {}) {
               : { HOME: isolatedHome, CODEX_HOME: isolatedHome }),
           };
 
+          // Resolve frozen timeoutMs from the expanded action (top-level).
+          // Default to 300000 for old plans. Fail closed on invalid values.
+          let frozenTimeoutMs;
+          try {
+            frozenTimeoutMs = resolveTimeoutMs(action);
+          } catch (timeoutErr) {
+            return createResult({
+              actionType,
+              status: ActionStatus.OBSERVED,
+              observation: { installed: false, error: timeoutErr.message },
+              error: timeoutErr.message,
+            });
+          }
+
           // Read execute evidence — mandatory for observe validation
           let evidence = null;
           try {
@@ -1095,7 +1162,7 @@ export function createPluginMarketplaceAdapter(deps = {}) {
 
           let listOutput;
           try {
-            const result = await exec(cliCmd, listArgs, { env, cwd: context.root });
+            const result = await exec(cliCmd, listArgs, { env, cwd: context.root, timeout: frozenTimeoutMs });
             listOutput = JSON.parse(result.stdout);
           } catch (listErr) {
             return createResult({